#!/bin/bash

#
# FUNCTION TABLE
#

no_copy()
{

#
# no_copy
#
# no_copy() overwrites the clipboard.
#
# A hexadecimal value of 00 is copied to the current clipboard via the pbcopy process.
#
# Should be a daemon.

    printf "\x00" | pbcopy
}

tightening()
{

#
# tightening
#
# Some general hardening options to set, such as enabling Gatekeeper,
# enabling software updates, adding sanity to the iCloud lifecycle, etc.
#

    # Enable Gatekeeper
    sudo spctl --master-enable

    # Enable updates
    sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate \
    AutomaticallyInstallMacOSUpdates -int 1

    # Disable Remote Events
    sudo systemsetup -setremoteappleevents off

    # Silence some iCloud sync stuff
    sudo defaults write com.apple.desktopservices DSDontWriteNetworkStores \
    -bool true
    sudo defaults write com.apple.desktopservices DSDontWriteUSBStores \
    -bool true
    sudo defaults write NSGlobalDomain NSDocumentSaveNewDocumentsToCloud \
    -bool false

    # Remove webcam extensions [Aggressive]
    sudo kextunload /System/Library/Extensions/AppleCameraInterface.kext 2>/dev/null
    sudo chmod a-r /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/VDC.plugin/Contents/MacOS/VDC 2>/dev/null
    sudo chmod a-r /System/Library/PrivateFrameworks/CoreMediaIOServicesPrivate.framework/Versions/A/Resources/AVC.plugin/Contents/MacOS/AVC 2>/dev/null
    sudo chmod a-r /System/Library/QuickTime/QuickTimeUSBVDCDigitizer.component/Contents/MacOS/QuickTimeUSBVDCDigitizer 2>/dev/null
    sudo chmod a-r /Library/CoreMediaIO/Plug-Ins/DAL/AppleCamera.plugin/Contents/MacOS/AppleCamera 2>/dev/null
}

killss()
{

#
# killss
#
# The screencapture process is triggered when screen shots are taken,
# as well as when the Screen Capture UI is called by the user.
#
# This condition will trigger a verbal warning if screencapture is
# seen as a running process, this is examined by ps.
#

	while true; do
        if [ -z "$(ps aux | grep screencapture | sed -n 2p)" ]; then
            :
        else
            say -r 240 " [[volm 0.03]] Screen-shot process active."
        fi
        sleep 5
    done
}

chrome_lock()
{

#
# chrome_lock
#
# Chrome history and login data files can be accessed within the Application Support directory.
#
# This will overwrite Chrome's history and login (password) files with an empty string.
# If the files contain any data, they are overwritten.
#
# chrome_lock() should be a daemon.
#

    CHROME_HIST_SIZE=$(stat -f "%z" \
                       "$HOME"/Library/Application\ Support/Google/Chrome/Default/History)
    CHROME_PWD_SIZE=$(stat -f "%z" \
                      "$HOME"/Library/Application\ Support/Google/Chrome/Default/Login\ Data)

    # Check for Chrome history files
    if [ "$CHROME_HIST_SIZE" -gt "1" ]; then
        # Clear Chrome history files
        find "$HOME"/Library/Application\ Support/Google/Chrome/Default/ \
        -iname "*History*" -exec bash -c 'printf "" > "{}"' \;
    else
        :
    fi

    # Check for Chrome password files
    if [ "$CHROME_PWD_SIZE" -gt "1" ]; then
        # Clear Chrome password / login files
        find "$HOME"/Library/Application\ Support/Google/Chrome/Default/ \
        -iname "*Login*" -exec bash -c 'printf "" > "{}"' \;
    else
        :
    fi
}

ios_backup_clear()
{

#
# ios_backup_clear
#
# iOS backups are often saved automatically to the local disk.
# These backup files can be found in the MobileSync directory within
# Application Support. These files may contain sensitive device information,
# as well as images stored on the mobile device.
#
# ios_backup_clear() removes all backup directories and files found within the
# MobileSync directory. If no backups are found, the function is skipped.
#
# Full-Disk Access needs to be given to the Terminal process / application
# to perform this function. The MobileSync folder has stock write protections
# that must be overridden.
#
# ios_backup_clear() should be a daemon.
#

    if [ -d "$HOME/Library/Application Support/MobileSync" ]; then   
        rm -rf "$HOME"/Library/Application\ Support/MobileSync/
    else
        :
    fi
}

cloud_block()
{

#
# cloud_block
#
# The launchd process runs at login, at this stage, launchd launches several processes.
# Many of the launchd processes are included to integrate iCloud functionality to the OS.
#
# cloud_block() disables and unloads processes inolving iCloud services loaded by launchd.
# .plist files, which are at-boot processes, are replaced so that rebooting the system 
# will not override these new rules.
#
# Some of these may not be disabled without first disabling SIP, though some should still
# work while SIP is enabled.
#

    # 3 arrays containing a collection of launchd processes as elements.
    CLOUD_AGENTS=(com.apple.AOSPushRelay com.apple.bird com.apple.CalendarAgent \
                  com.apple.CallHistoryPluginHelper com.apple.CallHistorySyncHelper \
                  com.apple.cloudd com.apple.cloudfamilyrestrictionsd-mac \
                  com.apple.cloudpaird com.apple.cloudphotosd \
                  com.apple.icloud.findmydeviced.findmydevice-user-agent \
                  com.apple.icloud.fmfd com.apple.iCloudUserNotifications \
                  com.apple.identityservicesd com.apple.SafariCloudHistoryPushAgent \
                  com.apple.safaridavclient com.apple.security.cloudkeychainproxy \
                  com.apple.security.cloudkeychainproxy3)

    CLOUD_DAEMONS=(com.apple.findmymacmessenger com.apple.icloud.findmydeviced \
                   com.apple.iCloudStats com.apple.ManagedClient.cloudconfigurationd \
                   com.apple.mbicloudsetupd com.apple.cloudd)

    SCREEN_PROCS=(com.apple.screensharing.agent com.apple.screensharing.menuextra \
                  com.apple.screencaptureui.agent com.apple.screensharing.MessagesAgent)

    # Unloading of processes
    sudo launchctl unload -w /System/Library/LaunchAgents/"${CLOUD_AGENTS[*]}".plist
    sudo launchctl unload -w /System/Library/LaunchAgents/"${CLOUD_DAEMONS[*]}".plist
    sudo launchctl unload -w /System/Library/LaunchAgents/"${SCREEN_PROCS[*]}".plist
    
    launchctl unload -w /System/Library/LaunchAgents/"${CLOUD_AGENTS[*]}".plist
    launchctl unload -w /System/Library/LaunchAgents/"${CLOUD_DAEMONS[*]}".plist
    launchctl unload -w /System/Library/LaunchAgents/"${SCREEN_PROCS[*]}".plist

    sudo mv /System/Library/LaunchAgents/${CLOUD_AGENTS[*]}.plist /System/Library/LaunchAgents/${CLOUD_AGENTS[*]}.plist.bak
    sudo mv /System/Library/LaunchAgents/${CLOUD_DAEMONS[*]}.plist /System/Library/LaunchAgents/${CLOUD_DAEMONS[*]}.plist.bak
    sudo mv /System/Library/LaunchAgents/${SCREEN_PROCS[*]}.plist /System/Library/LaunchAgents/${SCREEN_PROCS[*]}.plist.bak

}



#
# MAIN
#

main_helper()
{

#
# main_helper
# 
# In the legitimate main() function, killss() must be asynchronously launched
# with the main_helper() function to prevent the while loop in killss() from halting
# the main chain of functions.
#

    # One time launch of these functions
    cloud_block
    tightening

    # Infinitely loop these functions
    while true; do
        chrome_lock
        ios_backup_clear
        no_copy
        sleep 120
    done
}

# Actual MAIN() here.
killss & main_helper